Service
GSA CUI Gap Assessment
Know exactly where you stand. Our comprehensive gap assessment evaluates your cybersecurity posture against all 97 NIST 800-171 Rev 3 controls so you can move forward with confidence.
What Does the GSA CUI Gap Assessment Include?
It evaluates every aspect of your GSA compliance posture: all 97 NIST 800-171 Rev 3 controls, the 9 showstoppers, gap prioritization, a remediation roadmap, SSPP readiness and five-phase scoring.
Full 97-Control Analysis
We evaluate your organization against all 97 NIST 800-171 Rev 3 controls across 17 families, examining technical infrastructure, policies, procedures, and operational practices.
Showstopper Identification
Immediate identification of the 9 critical showstopper controls that GSA requires with no exceptions: multi-factor auth, encryption, flaw remediation, and more.
Gap Prioritization
Every gap is documented, categorized by severity, and prioritized based on risk impact and remediation complexity. You'll know exactly what to fix first.
Remediation Roadmap
Receive a clear, actionable roadmap with specific steps to close each gap, including timelines, resource estimates, and dependencies.
SSPP Readiness
Assessment output maps directly to System Security and Privacy Plan requirements, giving you a head start on your compliance documentation.
Five-Phase Scoring
Your results are scored against our five-phase readiness framework, giving you a clear picture of where you stand from Critical to Optimized.
What Are the 9 GSA Showstopper Controls?
They are the controls GSA requires with no exceptions. They must be fully implemented, with no POA&Ms allowed, so our assessment prioritizes these first.
Is There a Free Online GSA CUI Assessment?
Yes. Get an instant preliminary score across all 97 controls. Identify your readiness phase and showstopper status in minutes, with no commitment required.
Start Free AssessmentWhat Do Contractors Ask About the GSA CUI Gap Assessment?
What does the GSA CUI Gap Assessment evaluate?
It evaluates your organization against all 97 NIST 800-171 Rev 3 controls across 17 families, examining technical infrastructure, policies, procedures, and operational practices.
What are the GSA showstopper controls?
They are 9 controls GSA requires with no exceptions and no POA&Ms allowed: Multi-factor Authentication (03.05.03a), Encryption of CUI in Transit (03.13.08), Encryption of CUI at Rest (03.13.11), Flaw Remediation (03.14.01), Malicious Code Protection (03.14.02), Security Alerts & Advisories (03.14.03), Baseline Configurations (03.05.01), Vulnerability Scanning (03.11.02), and End-of-Life Risk Mitigation (03.16.02).
What do I receive at the end of the assessment?
Every gap is documented, categorized by severity, and prioritized based on risk impact and remediation complexity. You receive a remediation roadmap with specific steps to close each gap, including timelines, resource estimates, and dependencies, and your results are scored against the five-phase readiness framework from Critical to Optimized.
Does the assessment help with my System Security and Privacy Plan (SSPP)?
Yes. The assessment output maps directly to System Security and Privacy Plan requirements, giving you a head start on your compliance documentation.
How is the professional assessment different from the free online assessment?
The free online assessment gives an instant preliminary score across all 97 controls and shows your readiness phase and showstopper status in minutes. The in-depth professional gap assessment goes beyond the online tool; schedule a call with Rick at (571) 410-3066 to discuss your needs.
Ready for a Professional Assessment?
Our in-depth gap assessment goes beyond the online tool. Schedule a call with Rick to discuss your needs.
Last reviewed: October 9, 2026